registry / @zerohash-sdk/crypto-sell-js / 1.16.0
@zerohash-sdk/crypto-sell-js@1.16.0
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Crypto Sell product.
AI Security Review
scanned 26d ago · by lpm-firewall-aiStatic inspection found a browser widget SDK with package-aligned failure telemetry to hard-coded Zerohash collectors. The telemetry carries diagnostic context and does not establish malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
A browser invokes the widget loader and a loading failure is reported.
Impact
The package discloses routine diagnostic context to the vendor's telemetry service; inspected code does not establish credential theft or another attack.
Mechanism
The SDK posts session metadata, browser details, page origin, and failure context to an environment-specific Faro collector.
AI rationale
Static inspection found a browser widget SDK with package-aligned failure telemetry to hard-coded Zerohash collectors. The telemetry carries diagnostic context and does not establish malicious behavior.
Evidence
package.jsondist/index.d.tsdist/index.js
Network endpoints5
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a browser SDK entrypoint and declares no lifecycle scripts.
- The declaration file routes widget loading failures through the shared loader and supplies Faro collector URLs.
- The runtime reports widget loading failure details to hard-coded Zerohash Faro endpoints; the payload contains session metadata, browser details, page origin, and failure context.
- The reporter is invoked by the browser widget loader, which receives the SDK's configured collector URLs and JWT.
Evidence against
- No install-time execution or unrelated consumer mutation is present in the inspected manifest.
- The telemetry endpoint is selected from package-defined environment mappings, and the payload describes widget load failures rather than forwarding the JWT itself.
Behavioral surface
Network
MinifiedUrlStrings
Source & flagged code
6 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg228this.scriptLoadingPromise = new Promise<void>((resolve, reject) => {
loadWebComponentScript({
webComponentTag: this.webComponentTag,
appName: this.webComponentTag,
scriptUrls: this.getEffe
Low
Ai Review Evidence
The declaration file routes widget loading failures through the shared loader and supplies Faro collector URLs.
dist/index.d.tsView on unpkg · L228package.jsonView file
1{
"name": "@zerohash-sdk/crypto-sell-js",
"version": "1.16.0",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"require": "./dist/index.umd.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "crypto-sell-js"
}
}
Findings
1 High1 Medium6 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-sell-js@1.16.0.
See all versions of @zerohash-sdk/crypto-sell-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-sell-js@1.16.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.